OSINT Fundamentals and Methodologies 2 — Questions and Answers
Question 1: Which OSINT framework element refers to the systematic process of converting raw collected data into actionable intelligence?
- Data mining
- Analysis and production (Correct answer)
- Source validation
- Collection planning
Correct answer: Analysis and production
Analysis and production is the intelligence cycle phase where raw data is evaluated, interpreted, and transformed into finished, actionable intelligence products.
Question 2: An analyst needs to verify a social media account's authenticity. Which technique is MOST effective as a first step?
- Contact the account owner directly
- Reverse image search the profile picture (Correct answer)
- Report the account to the platform
- Block the account temporarily
Correct answer: Reverse image search the profile picture
Reverse image searching the profile picture can quickly reveal if the image is stolen from another source, indicating a fake account.
Question 3: What does the OSINT acronym 'HUMINT' refer to when contrasted with OSINT collection methods?
- Human Intelligence gathered from covert human sources (Correct answer)
- Humanized internet search techniques
- Automated human-behavior modeling tools
- Public records intelligence from human-readable files
Correct answer: Human Intelligence gathered from covert human sources
HUMINT (Human Intelligence) refers to intelligence gathered from covert or clandestine human sources, distinct from OSINT's publicly available information.
Question 4: Which of the following best describes 'pivoting' in an OSINT investigation?
- Switching to a different search engine
- Using one discovered data point to find additional related information (Correct answer)
- Archiving evidence before it disappears
- Changing the investigation's primary objective
Correct answer: Using one discovered data point to find additional related information
Pivoting means using a single piece of discovered information—such as an email or username—as a starting point to uncover additional linked data.
Question 5: A researcher discovers a website's WHOIS data is privacy-protected. What is the most appropriate next step?
- Abandon the domain as an intelligence source
- Use historical WHOIS records from services like DomainTools (Correct answer)
- File a legal request with the domain registrar
- Scan the site for open ports instead
Correct answer: Use historical WHOIS records from services like DomainTools
Historical WHOIS databases often retain registration data from before privacy protection was applied, providing useful ownership information.
Question 6: Which principle of OSINT methodology requires that collected information be evaluated against multiple independent sources before being treated as reliable?
- Source compartmentalization
- Corroboration (Correct answer)
- Data minimization
- Attribution mapping
Correct answer: Corroboration
Corroboration requires validating information by checking it against multiple independent sources to reduce the risk of acting on false or misleading data.
Question 7: When establishing an OSINT sock puppet account, which operational security practice is MOST critical?
- Using a VPN tied to your real identity
- Creating the account from your work IP address
- Using a dedicated device and separate network identity (Correct answer)
- Linking the persona to a real phone number for credibility
Correct answer: Using a dedicated device and separate network identity
A dedicated device with a separate network identity prevents cross-contamination between the sock puppet and the analyst's real identity or other investigative assets.
OSINT Fundamentals and Methodologies 2
Which OSINT framework element refers to the systematic process of converting raw collected data into actionable intelligence?